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REMARKS 

Claims 1-7, 11-17, and 21-27 remain pending in the application. Claims 8-10, 18-20, and 
28-30 are withdrawn pursuant to a preliminary election. If the examiner withdraws the 
restriction requirement, then claim 1 8 is amended to correct a minor error unrelated to the 
patentability of the claim. 



I- 35 U.S.C. S 121 

The Office Action requires a restriction to one of the following sets of claims: 
1. Claims 1-7, 1 1-17, and 21-27 (Group I); 
n. Claims 8-10, 18-20, and 28-30 (Group II). 
In response to the Restriction Requirement, Applicants provisionally elect Group I with traverse. 
The examiner states that: 

hiventions of Group I and Group H are related as subcombinations 
disclosed as usable together in a single combmation. The 
subcombinations are distinct bora each other if they are shown to be 
s^arately usable. In the instant case, invention Group I has separate 
utility such as classifying and logging events for reporting security 
situation by storing event attributes as an event set. An the invention 
Group n has the utility of performing mathematical operations such as 
addition, arithmetic mean, and geometric mean on a plurality of delta 
severity levels which is different from event logging and classification in 
Group I and it is used as a tool for establishing severity level for multiple 
groups of computers. See MPEP § 806.05(d). 
Office Action of Februaiy 15, 2005, p. 2. 

A4)plicants traverse the restriction requirement on the basis that the inventions in Group n 

do not have separate utility from the inventions in Group 1. For example, the invention described 

in claim 8, which is representative of Group H, does not have separate utility from the invention 

described in claim 1, which is representative of Group I Claim 1 is as follows (emphasis added): 

1 . A method in a data processing system for reporting security 
situations, comprising the steps of: 

logging events by storing event attributes as an event set, wherein 
each event set includes a source attribute, a target attribute 
and an event category attribute; 
classifying events as groups by aggregating ev^ts with at least one 

attribute within the event set as an identical value; 
calculating severity levels for the groups; 
calculating delta severities from the severity levels; and 
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propagating the delta severities to a higher-level correlation 
server. 

Claim 8 is as follows (emphasis added): 

8. A method, in a data processing system, of establishing a severity 
level for multiple groups of computers, comprising: 
receiving a plurality of delta severity levels; 
performing a first mathematical operation on the plurality of delta 

severity levels to form a new delta severity level; 
if the data processing system is the top level of a hierarchy of 

servers, performing a second mathematical operation on the 
new delta severity level and a stored severity level to form a 
new severity level; and 
if the data processing system is not the top level of a hierarchy of 
servers, propagating the new delta severity level to a 
higher-level correlation server. 
In issuing the restriction requirement, the examiner ignores the emphasized limitations of 
both claim 1 and claim 8. Claim 1 requires more than classifying and logging events as claimed. 
Claim 1 also requires the steps of calculating delta severities from the severity levels and 
propagating the delta severities to a higher-level correlation server. Similarly, claun 8 requires 
more than just perfonning mathematical operations on a plurality of delta severities. Claim 8 
also describes how to process delta severities once calculated. Because the examiner ignored 
these limitations, the examiner missed the fact that claims 1 and 8 do not have separate utility. 
When the two claims are read side-by-side, one readily sees that claim 8 clearly describes details 
of a process such as that described in claim 1. Moreover, claim 8 is not understandable without 
the disclosure related to claim 1 . 

A restriction requirement is not proper if the subcombination does not have separate 
utility over the other combination or subcombination. MPEP § 806.05(d); see also MPEP § 
806.05(c). In this case, the subcombination described in claim 8 does not have utility over the 
combination described in claim 1 because the invention of claim 8 could not be used without 
understanding the invention of claim 1, One of ordinary skill would not understand the context 
of claim 8 such as. for example, why or how one would receive delta security levels, why or how 
one would perform "a first mathematical cooperation. , .to form a new delta security level," why 
or how one would perform "a second mathematical operation on the new delta severity level" if 
the data processing system is the top level of a hierarchy of services, or why or how one would 
propagate "the new delta severity level to a higher-level correlation server^' if the data processing 
system is not the top level of a hierarchy of servers. Whereas the invention of claim 8 makes 
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sense as an independent claim in the context of the overall disclosure and in the context of the 
invention of claim 1, claim 8 has no use beyond the methods described in the application. Thus, 
the invention of claim 8 does not have separate utiUty with respect to the invention of claim 1. 
Accordingly, the restriction requirement is improper and should be withdrawn. 

hi addition, the examiner has the burden to show how the invention of claim 1 has 
separate utUity from the invention of claim 8. MPEP § 806.05(d). hi view of the above, and m 
view that the examiner ignored limitations of both claims 1 and 8 when fashioning the restriction 
requirement, the examiner has failed to meet this burden. Thus, the examiner has failed to state a 
proper restriction requirement. Applicants therefore request that the restriction requirement be 
withdrawn. 

Claims 1 and 8 are representative of Groups I and H, respectively. Thus, the restriction 
requirement with respect to the other claims should be withdrawn for the same reasons described 
above. 

Although the restriction requirement is improper, Applicants are required to elect 
provisionally one of the groups identified by the examiner. Applicants hereby elect Group I, 
claims 1-7, 11-17, and 21-27 with traverse. 
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II. Conclusion 

Applicants request that the restriction requirement be withdrawn and that all claims be 
allowed. 

The Examiner is invited to call the undersigned at the below-listed telephone number if in 
the opinion of the Examiner such a telephone conference would expedite or aid the prosecution 
and examination of this application. 



DATE: (/IV^<\Uf\ \<S^^OOS 



Respectfully submitted. 




Theodore D/Faym 
Reg. No. 48,504 
Yee & Associates, P*C. 
P.O. Box 802333 
Dallas, TX 75380 
(972) 385-8777 
Attorney for Applicants 
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